Which versions of panrouter-admin are malicious?

The following npm versions of panrouter-admin are flagged malicious: 5.0.0. Treat any of these as compromised.

How do I remediate panrouter-admin if I installed it?

panrouter-admin establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.

I already installed panrouter-admin — how do I know if it already compromised me?

If panrouter-admin was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is panrouter-admin part of a known attack campaign?

Yes — panrouter-admin is associated with the IN-MAL-2026-007005 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find panrouter-admin across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for panrouter-admin (version 5.0.0).

Malicious package

panrouter-adminnpm

Advisory published Jun 18, 2026Updated Jun 18, 2026

panrouter-admin is a confirmed malicious npm package (MAL-2026-6134) that opens a backdoor for remote access (malicious version 5.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in panrouter-admin (npm)

MAL-2026-6134

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall panrouter-admin

What this malware does

panrouter-admin ships relay_client.cjs, which connects to a hardcoded WebSocket endpoint at wss://jiuling.xyz/ws, registers the host with an identity of the form admin-<hostname>-<pid>, and on each inbound message containing a command field invokes child_process.execSync and returns stdout/stderr/exitCode back over the WebSocket. This is a fully functional reverse-shell / C2 implant: the operator of jiuling.xyz can execute arbitrary OS commands on any machine running this script. The implant uses exponential-backoff reconnects and a single-instance lock (port 28999) for resilience. A companion HTTP server (server.mjs) exposes /api/relay-devices proxying https://jiuling.xyz/api/devices, confirming jiuling.xyz is the author's fleet-management plane. Additionally, cli.mjs rewrites ~/.claude/settings.json to set ANTHROPIC_BASE_URL=http://127.0.0.1:50816 and ANTHROPIC_AUTH_TOKEN=public, routing all Claude Code prompts through the local server which forwards them to opencode.ai — silently relaying potentially sensitive prompt content (proprietary code, secrets) through author-controlled infrastructure. tray-daemon.ps1 offers an HKCU Run-key autostart (PanRouterAdmin) for a hidden PowerShell tray, providing persistence on Windows.

Malicious versions

1 flagged

5.0.0

Indicators of compromise (SHA-256)

390c706978c9207807a0aeb4b1e3dfc500847828c23f5ffb06a14171ca8e51e6

Detection & response playbook

Backdoor / remote access

Find it
Search your lockfiles and build artifacts for panrouter-admin (version 5.0.0).
If you installed it — respond
panrouter-admin establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.
Did it already run?
If panrouter-admin was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. panrouter-admin on npm has been identified as a malicious package (version 5.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-007005

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks panrouter-admin-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the C2 callback and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database